Loading malware…
BlackByte is a ransomware family and ransomware-as-a-service operation first observed in 2021 that has targeted organizations worldwide, including U.S. critical infrastructure sectors such as government facilities, financial services, and food and agriculture. It is primarily a Windows-focused threat that encrypts files on compromised physical and virtual systems and is associated with double-extortion operations in which attackers steal data before encryption and threaten public release through leak-site infrastructure if victims do not pay.
BlackByte evolved from early C# implementations to later Go-based variants, including more feature-rich versions introduced in 2022. Reported behavior includes shadow copy deletion, disabling or terminating security products and business-critical services, partial or full file encryption, ransom-note deployment, and post-encryption extortion via victim portals and negotiation channels. The malware has also been observed using process hollowing and process injection for defense evasion, including injection into legitimate Windows processes, and some variants delete their on-disk binary after execution. Additional anti-analysis and anti-defense measures include string obfuscation, packing, sandbox and debugger checks, firewall and Defender tampering, and attempts to interfere with recovery tooling.
Operationally, BlackByte intrusions have been linked to exploitation of unpatched internet-facing systems, especially Microsoft Exchange vulnerabilities including ProxyShell and ProxyLogon, as well as phishing-based access. After initial compromise, operators and affiliates have used legitimate administrative tools and commodity utilities for reconnaissance, privilege escalation, persistence, lateral movement, and remote execution. Observed tradecraft includes host and Active Directory enumeration, enabling network discovery and file sharing, copying payloads to remote systems, scheduled-task execution, and targeting administrative shares and backup repositories. Multiple reports also describe data exfiltration preceding ransomware deployment, and at least one affiliate used a custom Go-based exfiltration tool to accelerate theft of victim documents.
BlackByte has been described as a mature and evolving criminal operation whose tooling changed after weaknesses in early encryption implementations enabled public decryption. Later variants adopted stronger cryptographic schemes and expanded functionality, reinforcing its position as a significant enterprise ransomware threat.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access. | Symantec’s Threat Hunter Team has discovered that at least one affiliate of the BlackByte ransomware (Ransom.Blackbyte) operation has begun using a custom data exfiltration tool during their attacks.
In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access. | Symantec’s Threat Hunter Team has discovered that at least one affiliate of the BlackByte ransomware (Ransom.Blackbyte) operation has begun using a custom data exfiltration tool during their attacks.
Le groupe de ransomware BlackByte exploite activement la vulnérabilité « CVE-2024-37085 » de contournement d'authentification récemment corrigée dans les hyperviseurs VMware ESXi pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
The following analytic detects when su runs from a page-cache-corrupted binary... This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access... CVE CVE-2026-31431 ... References ... copy-fail-CVE-2026-31431
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
Associated Analytic Story BlackByte Ransomware ... Citrix ShareFile RCE CVE-2023-24489 ...
The following analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \" command.
The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902.
The following analytic detects suspicious process access by spoolsv.exe, potentially indicating exploitation of the PrintNightmare vulnerability (CVE-2021-34527).
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Symantec’s Threat Hunter Team has discovered that at least one affiliate of the BlackByte ransomware (Ransom.Blackbyte) operation has begun using a custom data exfiltration tool during their attacks.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
BlackByte uses the Windows task scheduler to execute the ransomware on the remote host... schtasks.exe /Create /S /TN /TR "C:\Users\Public\ -s " /ru SYSTEM /sc onlogon /RL HIGHEST /f
BlackByte uses the Windows task scheduler to execute the ransomware on the remote host... schtasks.exe /Create /S /TN /TR "C:\Users\Public\ -s " /ru SYSTEM /sc onlogon /RL HIGHEST /f
... vulnérabilité « CVE-2024-37085 » de contournement d'authentification ... pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
The ransomware executes the following commands to disable UAC remote restrictions... reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy... BlackByte sets the EnableLinkedConnections registry value...
The adversary remotely created a draft email with an attachment saved in the user’s Drafts folder... exported the entire mailbox to a PST file format, with an ASPX extension... writing an ASPX file to the folder ...\owa\auth\current\themes (T1505.003 Server Software Component: Web Shell).
BlackByte uses the Windows task scheduler to execute the ransomware on the remote host... schtasks.exe /Create /S /TN /TR "C:\Users\Public\ -s " /ru SYSTEM /sc onlogon /RL HIGHEST /f
BlackByte v1 injects the ransomware code in an instance of regedit.exe , while BlackByte v2 injects itself into an instance of svchost.exe.
... vulnérabilité « CVE-2024-37085 » de contournement d'authentification ... pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
Both Go-based BlackByte variants encrypt most strings using a tool similar to AdvObfuscator... Each string is decrypted using a unique algorithm with polymorphic code
BlackByte samples are typically packed with UPX... the most recent BlackByte samples... are packed with a modified version of UPX. The names of the sections have been renamed from UPX0 and UPX1 to BB0 and BB1
BlackByte v1 injects the ransomware code in an instance of regedit.exe , while BlackByte v2 injects itself into an instance of svchost.exe.
BlackByte then deletes its original binary on disk by executing the command: C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 10 > Nul & Del /F /Q
BlackByte removes traces after execution and changes timestamps, complicating an investigation that starts after files have already been locked.
... vulnérabilité « CVE-2024-37085 » de contournement d'authentification ... pour déployer des ransomwares et obtenir un accès administratif complet aux réseaux des victimes.
Import-Module ActiveDirectory;Get-ADComputer -Filter * -Properties * | FT Name
The following commands are then executed to discover other computers and network file shares: net view arp -a
BlackByte ransomware terminates the following processes shown in Table 2 at the beginning of the execution... Many of these process names are related to business applications... In addition, the list contains a large number of malware analyst tools
In order to identify virtual machines on the victim's system, BlackByte will execute the command: powershell Get-VM
The malware executes mountvol.exe to try to mount additional volumes... This is likely an attempt to mount and encrypt backup volumes
BlackByte is a full-featured ransomware family... The threat group exfiltrates data prior to deploying ransomware... BlackByte renames encrypted files with the extension .blackbyte .
The following commands are executed by BlackByte to stop services that may hinder file encryption... BlackByte also terminates the following services that are associated with antivirus products, backup software, and business applications
68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
134 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family noted for anti-forensics behavior, including removing traces after execution and altering timestamps.
Ransomware family mentioned as an example of malware associated with multivector attacks where DDoS is used as a smokescreen.
Annotations ID Technique Tactic T1078 Valid Accounts Initial Access T1098 Account Manipulation Persistence T1548.001 Setuid and Setgid Privilege Escalation Delivery Installation Exploitation ... BlackByte ...
Annotations ID Technique Tactic T1055 Process Injection Privilege Escalation APT37 APT38 APT41 APT5 AppleJeus BlackByte Cobalt Group Gamaredon Group Kimsuky PLATINUM Sandworm Team Silence TA2541 Turla UNC3886 Velvet Ant Wizard Spider
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.